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Case Study: 1, Contoso, Ltd (Case Study B) 
Background 


You are the system administrator for a manufacturing company named Contoso, Ltd. 
The company has offices in Chicago, Seattle, and Dallas. 


Contoso’s sales department is located in Chicago. The U department is located in 
Seattle. The sales and IT departments use Microsoft Exchange Online, SharePoint 
Online, and OneDrive for Business. All employees in the sales department are in a 
group named Sales-Users. Employee user accounts are added and removed 
manually to this group as needed. 


Your Active Directory Domain Services (AD DS) domain is named conto50.com. The 
domain is synchronized with Contoso s Office 365 tenant using Microsoft Azure 
Active Directory (Azure AD) Connect. 


Contoso purchases a toy manufacturer named Tailspin Toys. All employees are 
located in Dallas. 


Tailspin Toys has an on-premises Exchange Server 2016 for all email in the 
tailspintoys.com domain. There are plans to migrate the users to Exchange Online. 


Business Requirements 

Email Security: You need to ensure email security meets the following requirements 
e Sales users can easily Identify email messages as internal only. 

e Sensitive emails can not be forwarded externally. 

e Sensitive emails can not be sent to external recipients 

Licenses: You need to be able to identify which Tailspin Toys users are licensed. 
Support Contracts: Your company does not currently have any Microsoft support 
contracts. 

Skype for Business pilot: You have recently purchased Skype for Business Online 
licenses and you plan to pilot the service with IT users. You also want to start 
utilizing dynamic groups for licensing You have a dynamic group called FS-Users 
that contains all users in The FT department. 

Technical Requirements: 

Single Sign-On (SSO): You have the following requirements tor SSO: 

e Ensure that users receive a phone call or text message as a second form of 
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authentication when accessing Office 365 or on-premises resources. 

e "he domain for federation must be fs.contoso.com. 

e "he solution must support extranet users. 

e "he solution must use Windows Integrated Authentication. » The solution must 
support device registration. 

e The solution must be highly availability. 

e The solution must be secured as much as possible. 

Servers: Vou deploy Active Directory Federation Services (AD FS) and Web 
Application Proxy (WAP) services using Windows Server 2016. You deploy System 
Center Configuration Manager (SCCM) and System Center 

Operations Manager (SCOM) in the contoso.com domain. 

Monitoring: You need to be able to monitor and identify issues in the Office 365 
environment. 

Pilot: You plan to use a group of 25 Tailspin Toys users to test the functionality of 
Exchange Online. If the pilot is successful, you must migrate all other users to 
Exchange Online. 

Tailspin Toys users must meet the following requirements: 

e Must not exist in an on-premises Active Directory. 

e The usernames must be unique. 

e Display names can be unique. 

e The tenants for tailspintoys.com and contoso.com must be separate. 

e Passwords must expire after 365 days. 

e Must receive a notification 14 days before passwords expire. 

Issues: User 1 is one of the pilot users for Tailspin toys. User1 reports that Outlook 
prompts them to enter credentials. You confirm that the employee is using the 
correct password. You run the Microsoft Support and Recovery Assistant for Office 
365. The tool does not identify any issues. 


Question: 1 


HOTSPOT 

You need to use the Office 365 admin center portal to create the report for the 
Dallas office. Which values should you use? To answer, select the appropriate 
options in the answer are 

a. NOTE: Each correct selection is worth one point. 
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License Assigned Date Exchange 
License Assigned Date SharePoint 
License Assigned Date OneDrive 
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Answer: 


Report name Active users 


1 User name 
2 License for Exchange 
3 License Assigned Date OneDrive 


Question: 2 
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You need to resolve the issue for Used. What should you do? 


A. Open a service request in the Office 365 admin center. 
B. Create a new ticket with Microsoft Premier Support. 

C. Reset the account password for the user. 

D. Run the Office 365 Client Performance Analyzer. 


Answer: D 


Question: 3 


You need to monitor the tailspintoys.com user accounts. What should you do? 


A. Access the Seivice health dashboard on the Office 365 admin center. 
B. Access the SCOM console. 
C. Run the following Windows PowerShell cmdlet; 
Get-ServiceDeliveryReport 
D. Access the RSS feed for Office 365 service health. 
E. Run the following Windows PowerShell cmdlet: 
Get-HistoricalSearch 


Answer: C 


Case Study: 2, Fabrikam, Inc (Case B) 

Fabrikam is a manufacturing company. You manage an on-premises Microsoft 
Exchange Server environment as well as an Exchange Online environment that is 
se: up as a hybrid environment for the Fabnkam.com and devfabrikamxom domains. 
The company recently merged with lailSpin Toys. They have also bought another 
company named Contoso Ltd. There are no plans to merge with Contoso Ltd. as 
that company s resources will remain separate from Fabrikam. Inc. 


Domains 


Fabrikam, Inc. has two separate Active Directory Domain Services (AD DS) 
domains. The domain named fabrikam.com is used for production. The domain 
named devfabfikam.com is used for development only. TailSpin Toys has an AD DS 
domain named tdilspmtoys.com. Contoso Ltd. has an AD DS domain twined 
contoso.com. 
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The development environment is used to deploy new features that are being tested 
for implementation in the production environment. No features can be deployed into 
production until they ha<je been fully tested in the development environment. There 
is a "hird-party multi-factor authentication \MFA) solution that is currently deployed 
for on premises sign ins in the dovfabfikam.com domain. You are investigating 
different single sign on(SSO) options including Active Directory Federations Services 
(AD FS) for the devfabrikam.com domain. 


Fabrikara Inc. is completing its merger with TailSpin Toys and is decommissioning 
the lailspintoys.com namespace and moving those users lo fabnkam.com. 


Fabrikam has Microsoft Azure Active Directory (Azure AD) Connect configured and 
has integrated both the fabnkam.com and devfabrikam.com domains with Office 
365. SSO is configured for both the fabrikam.com and devtabrikam.com domains. 


Office 365 
The Office 365 environment must meet the following requirements: 


e SSO most be used for all Office 365 authentication in production and development 
environments for all domains. 


e Sign in time restrictions must be enabled for all contoso.com users in the Office 
365 environment. 


e Exchange Online must be used for all production employee mailboxes. 
e The on premises contoso.com domain must be integrated with Office 365. 


e Contoso.com must be used for the primary namespace in Office 365 for Contoso 
Ltd. employees. 


Infrastructure 
The server infrastructure must meet the following requirements: 
Production environment 


e All now applications that require relational database support must use Microsoft 
SQL Server ?016. 


e All new projects must minimize the number of servers required. 


e All new projects must minimize the complexity of the design and topology of the 
server infrastructure. 


e All externally facing servers must be deployed in a perimeter network- 
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e All new server deployments should be redundant when possible. 
Development environment 

e The development environment must support workplace join. 

e On premises MFA must be used for all development accounts. 
Issues 


Users report that they receive many unwanted emails. You need to a create a list of 
the users that receive the most unwanted emails, and a list of the senders of these 

emails. This report information needs to be automatically collected daily. Users also 
report the following issues: 


e The mailbox named Test.Userl@tievfabrikam.com is hosted in the on-premises 
Exchange Servers. This user is not able to view free/busy for 
Test.User2@cievfabrikam.com. Test User1 has issues viewing free/busy from both 
Microsoft Outlook 2016 on a desktop computer as well as the Outlook app on a 
mobile device. 


e The Test.User2@devfabnkam.com account has a mailbox that is hosted in the 
Exchange Online environment 


e The AlexSimmons“fabnkam.com is hosted in Exchange Online. Alex reports 
Outlook 2016 issues. The client application starts up and connects to his mailbox, 
but it will then crash after a few minutes. 


e The mailbox named Lola.Jacobsen@fabrikam.com is hosted in Exchange Online. 
An Exchange Online mailbox database issue affected Lola and some other users in 
the human resources department. You need to troubleshoot client connectivity 
issues with Lola s mailbox 


e The mailbox named Sarah.Jones@fabrikam com account is hosted in Exchange 
Online. Sarah reports that emails that she sends are not being received. You must 
inspect emails that Sarah has sent recently to investigate the issue. 


Question: 4 


Note: This question is part of a series of questions that present the same scenario. 
Each question in the series holds a unique solution that might meet the stated goals. 
Some question sets might have more than one correct solution, while others might 
not have a correct solution. 
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After you answer a question in this section, you will NOT be able to return to it. As a 
result, these questions will not appear in the review screen. 


You need to implement the integration between Active Directory and Office 365 for 
the new domain. 


Solution: Create a tenant for tailspintoys.com. Perform a Custom installation of 
Azure AD Connect. 


Does the solution meet the goal? 


A. Yes 
B. No 


Answer: B 


Question: 5 


Note: This question is part of a series of questions that present the same scenario. 
Each question in the series holds a unique solution that might meet the stated goals. 
Some question sets might have more than one correct solution, while others might 
not have a correct solution. 


After you answer a question in this section, you will NOT be able to return to it. As a 
result, these questions will not appear in the review screen. 


You need to implement the integration between Active Directory and Office 365 for 
the new domain. 


Solution: Create a tenant for tailspintoys.com. Perform an Express installation of 
Azure AD Connect. 


Does the solution meet the goal? 


A. Yes 
B. No 
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Answer: B 


Question: 6 


Note: This question is part of a series of questions that present the same scenario. 
Each question in the series holds a unique solution that might meet the stated goals. 
Some question sets might have more than one correct solution, while others might 
not have a correct solution. 


After you answer a question in this section, you will NOT be able to return to it. As a 
result, these questions will not appear in the review screen. 


You need to implement the integration between Active Directory and Office 365 for 
the new domain. 


Solution: Create a tenant for contoso.com. Perform a Custom installation of Azure 
AD Connect. 


Does the solution meet the goal? 


A. Yes 
B. No 


Answer: A 


References: 
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect- 
install-custom 


Question: 7 


HOTSPOT 
You need to design the SSO solution for the Development environment. 


How should you configure the environment? To answer, select the appropriate 
options in the answer area. 
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NOTE: Each correct selection is worth one point. 


Component Option 


Web Application Proxy (WAP) | Ì X 


1 server 
2 servers 


| , vv 
AD FS X 
1 server 
Database ~ 
Windows Internal Database 
Microsoft SOL Server database 
Answer: 
Component Option 
Web Application Proxy (WAP 2 servers Y 
AD FS 2 servers w: 
Matoh A æ cr Cams m De » 
Database Microsoft SOL Server database 


Question: 8 


DRAG DROP 
You need to configure DNS for the AD FS deployment. 


Which DNS entries should you use? To answer, drag the appropriate DNS entries to 
the correct topologies, Each entry may be used once, more than once, or not at all. 
You may need to drag the split bar between panes or scroll to view content 


NOTE: Each correct selection is worth one point. 
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ONS entries a Answer area 
Fs.fabrikam.com AD FS topology DNS entry 
Fs.tailspintoys.com Perimeter Network Namespace DNS entry 
Fs.deviabrikam.com > Internal Network Namespace DNS entry 


Enterprisereqistration.fabrikam.com 
Server Lfabrikam.com 

Server L.devfabrikam.com 

Server Ltailspintoys.com 


Enterpriseregistration. taiispintoys.com 


Answer: 


AD FS topology DNS entry 


Perimeter Network Namespace ~ Fs devfabrikam.com 
Internal Network Namespace | Enterpriseregistration.fabrikam.com 


Question: 9 


You need to troubleshoot issues that Test.User1 reports. 


What should you do? 


A. Run the Microsoft Support and Recovery Assistant for Office 365. 
B. Repair the Office ProPlus installation. 
C. Run the hybrid environment free/busy troubleshooter. 


D. Run The Microsoft Office Configuration Analyzer Tool. 


Answer: C 


References: 
https://support.microsoft.com/en-gb/help/10092/troubleshooting-free-busy-issues-in- 
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exchange-hybrid-environment 


Question: 10 


DRAG DROP 
You need to implement authentication. 


Which sign-in methods should you use? To answer, drag the appropriate sign-in 
methods to the correct Office JGS environments, Each method may be used once, 
more than once, or not at all. You may need to Crag the split bar between panes or 
scroll to view content. 


NOTE: Each correct selection is worth one point. 


Sign-in methods Answer area 
Password hash synchronization with SSO Office 365 environment Sign-in method 
Pass-through authentication with SSO Contoso.com Sign-in method 
AD FS Devfabrikam.com Sign-in method 


Azure AD sign-in 


Answer: 
Answer area 
Office 365 environment Sign-in method 
Contoso.com AD FS 
Devfabrikam.com AD FS 


Question: 11 
You need to gather the required report information for your email users. What 


should you do? 


A. In the Security & Compliance admin center, use the Top Mail Senders report. 
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B. In the Exchange admin center, use the spam filter. 
C. In the Office 365 Admin center, use the Email Activity Usage report 
D. In the Office 365 Admin center, use the Top Rule Matches for Mail report. 


E. In the Security & Compliance admin center, use the Spam Detections report 


Answer: A 


References: 


https://docs.microsoft.com/en-us/office365/securitycompliance/view-email-security- 
reports#top-senders-and-recipients-report 


Question: 12 


You need to troubleshoot the issues for user Alex.Simmons. What should you run? 


A. hybrid environment free/busy troubleshooter 
B. Microsoft Office Outlook Connectivity Tests 
C. Microsoft Office Configuration Analyzer Tool 


D. Microsoft Office 365 Client Performance Analyzer 


Answer: C 


Question: 13 


HOTSPOT 
You need to troubleshoot the issues for user Lola.Jacobsen. 


Which command should you run? To answer, select the appropriate options in the 
answer area. 


NOTE: Each correct selection is worth one point 
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§ Identity Lola. Jacobsen@fabrikam.com ` 


Test-Mapiconnectivity 
Test-OAuthConnectivity 


Test-ServiceHealt? 


Test-UMConnectivity 


Answer: 
Test-MapiConnectivity ni Identity Lola. Jacobsen@fabrikam.com ` 
-Archive + 
References: 


https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/test- 
mapiconnectivity?view=exchange-ps 


Question: 14 


You need to request a certificate for AD FS. 


Which two options should you use? Each correct answer presents part of tt>e 
solution. 


NOTE: Each correct selection is worth one point 


A. Subject Alternate Names of fs.devfabrikam.com and 
enterpriseregistration.devfabrikam.com 


B. Subject name of fs.fabrikam.com 
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C. Subject Alternate Names of fs.windows.net and 
enterpriseregistration.windows.net 


D. Subject name of fs.devfabrikam.com 


E. Subject Alternate Names of fs.fabnkam.com and 
enterpriseregistration.fabrikam.com 


Answer: DE 


Question: 15 


HOTSPOT 
You need to troubleshoot the issues for user Sarah.Jones. 


How should you complete the command? To answer, select the appropriate options 
to the answer area. 


NOTE: Each correct selection is worth one point 


Y|" Sarah. Jones@fabrikas.com 


-SenderAddriat 


-Recipient 


-Sender 


Answer: 


Get-MessageTrace -RecipientAddress 


Get-MessageClassification -SenderAddress 
Get-MessageTrackingReport -Recipient 
Get-SystemMessage -Sender 


References: 


https://docs.microsoft.com/en-us/powershell/module/exchange/mail-flow/get- 
messagetrace?view=exchange-ps 
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Question: 16 


You need to implement the integration between Active Directory and Office 365 for 
the new domain. 

Solution: Create a tenant for contoso.com. Perform an Express installation of Azure 
AD Connect. 

Does the solution meet the goal? 


A. Yes 
B. No 


Answer: B 


References: 
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect- 
install-express 


Case Study: 3, Provision Office 365 


Question: 17 


You administer the Office 365 environment for a company that has offices around 
the world. All of the offices use the same Office 365 tenant. 

You need to ensure that all users can access the services that are available in their 
regions. 

Which setting or service should you update? 


A. User location settings 
B. User licenses 

C. Service usage address 
D. Rights management 


Answer: A 


The User Location settings will allow you to set sign-in status and user locations for 
all the users that are on your network notwithstanding the physical location where 
they find themselves. 

References: 
http://blogs.perficient.com/microsoft/201 4/11 /office-365-assign-licensing-user- 
location-via-active-directory/ 
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Question: 18 


Your company purchases an Office 365 plan. The company has an Active Directory 
Domain Services domain. 

User1 must to manage Office 365 delegation for the company. 

You need to ensure that User1 can assign administrative roles to other users. 
What should you do? 


A. Create an Office 365 tenant and assign User1 the password administrator role. 
B. Use a password administrator account to assign the role to User1. 

C. Use a user management administrator account to assign the role to User1. 

D. Create an Office 365 tenant and assign User1 the global administrator role. 


Answer: D 


The Global Administrator account is similar to the Company administrator. Users in 
this role have access to everything or the permission to add them to a dedicated role 
where they do not have permission (Such as discovery management and assigning 
administrative roles to other users). 

References: 
https://support.office.com/client/Assigning-admin-roles-eac4d046-1 afd-4f1a-85fc- 
8219c79e1504 


Question: 19 


DRAG DROP 

A company plans to implement an Office 365 environment to manage email. 

All user accounts must be configured to use only a custom domain. 

You need to provision an Office 365 tenant for the company. 

Which three actions should you perform in sequence? To answer, move the 
appropriate actions from the list of actions to the answer area and arrange them in 
the correct order. 
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HH 


Answer Area 
Configure the global administrator account recovery 
information. 
Remove the domain name onmicrosoft.com. 


Select the Office 365 plan. 


Configure the custom domain and DNS. 


Answer: 


Box 1: 


Select the Office 365 plan. 


Box 2: 
Configure the global administrator account recovery information 
Box 3: 


Configure the custom domain and DNS, 


The tenant is your Office 365 account, including hosted Exchange, Skype for 
Business, SharePoint, and your Office 365 Active Directory. The first account that 
you create when you first purchase Office 365 is the “owner” of your tenant. This 
account should be an admin account, not a person. This account does not normally 
require an Office 365 license. Relating to SharePoint, all of your site collections are 
within your tenant. You can have any number of domains within your tenant (with e- 
mail accounts), but you will have only one root SharePoint 
URL:https://xxxx.sharepoint.com. 

The Global Administrator account is similar to the Company administrator. Users in 
this role have access to everything or the permission to add them to a dedicated role 
where they do not have permission (such as discovery management and assigning 
administrative roles to other users). 

When setting up Office 365 the first step is to purchase your subscription which 
includes choosing the plan. Step 2 involves the selection of the sign-on method and 
this is where the global administrator account is of consequence. Step 3 involves the 
collecting of information such as domain names and DNS, locations, etc... 

Step4 is the actual migration plan and schedule, step 5 — the Microsoft account and 
organizational account, step 6 — the SkyDrive and SkyDrive Pro, and step 7 — the 
Windows Intune section. 

Thus you should perform step 1 through 3 to ensure that all user accounts to make 
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use of a custom domain for their e-mail. 

References: 

Katzer, Matthew and Don Crawford, Office 365 Migrating and Managing your 
Business in the Cloud, Apress Media, New York, 2013, pp 87- 93, 373 
http://office.microsoft.com/en-gb/office365-suite-help/add-your-domain-to-office-365- 
HA102818660.aspx 


Question: 20 


Your company has 100 user mailboxes. The company purchases a 
subscription to Office 365 for professionals and small businesses. You need 
to enable the Litigation Hold feature for each mailbox. 


What should you do first? 


A. Purchase a subscription to Office 365 for midsize business and enterprises. 
B. Enable audit logging for all of the mailboxes. 

C. Modify the default retention policy. 

D. Create a service request. 


Answer: A 


The first step will always be the purchasing the correct Office 365 plan to suit your 
needs. There are three plans of Office 365: Professional, Mid-Size Businesses, and 
Enterprise. The Office 365 Mid-sized businesses and Enterprise plans will allow you 
to enable Litigation Hold. The Professional plan is not compliant with this setting. 
User mailboxes that are placed under litigation hold with the external audit enabled 
meet all compliance requirements, because the data is immutable. 
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